docs: record git-cas v6.5.2 publication

[flyingrobots]

Linked Issue

• Refs perf: reuse bounded Git object sessions #90.
• The issue will be closed explicitly after merge with source citations to the landed publication witness and executable release-state contract.

Summary

• record the signed v6.5.2 tag, reviewed merge, and successful release workflow
• record npm integrity, shasum, size, dist-tag, and SLSA provenance evidence
• advance STATUS.md from release candidate to published artifact posture
• make the release-state contract require the immutable publication witness

Design / Proof

• Design doc: docs/design/0052-persistent-git-object-sessions/persistent-git-object-sessions.md
• Release candidate: docs/design/0052-persistent-git-object-sessions/witness/release-candidate.md
• Publication witness: docs/design/0052-persistent-git-object-sessions/witness/release-publication.md
• External proof: signed tag v6.5.2, release workflow 29690794540, npm attestations, and final GitHub Release

Validation

pnpm exec prettier --check STATUS.md docs/design/0052-persistent-git-object-sessions/witness/release-publication.md test/unit/docs/release-state.test.js
pnpm exec vitest run test/unit/docs/release-state.test.js test/unit/docs/release-truth.test.js test/unit/docs/package-docs.test.js
pnpm run lint
pnpm test

• Focused release contracts: 30 passed.
• Pre-push Node unit gate: 223 files, 2,080 passed, 2 skipped.
• Hosted lint, unit, and Node/Bun/Deno real-Git integration checks passed.
• Release workflow 29690794540 succeeded.
• npm and GitHub Release were queried independently after publication.

Release Impact

• Changelog updated, if release behavior changed. The release candidate already landed the v6.5.2 changelog entry.
• Public docs updated, if user-facing behavior changed. STATUS.md and the immutable publication witness now report shipped reality.
• Issue labels/milestone reflect final disposition. perf: reuse bounded Git object sessions #90 remains in the v6.5.2 milestone until this evidence PR merges.

[coderabbitai]

📝 Walkthrough

Walkthrough

The release records now identify v6.5.2 as published with signed-tag, GitHub Release, npm, and provenance evidence. Release-state tests validate the publication witness and updated v6.6.0 queue goalposts while preserving candidate and prior-release evidence checks.

Changes

Release publication state

Layer / File(s)	Summary
Publication record and status STATUS.md, docs/design/.../witness/release-publication.md	Updates v6.5.2 to published status, records release identity and workflow evidence, documents npm and attestation data, and advances the active queue to v6.6.0 goalposts.
Release-state validation test/unit/docs/release-state.test.js	Separates candidate and published evidence checks and validates the updated status, publication witness, release markers, hashes, workflow links, npm metadata, and attestations.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• git-stunts/git-cas#91: Updates the same v6.5.2 release-status artifacts and goalpost evidence.
• git-stunts/git-cas#80: Uses the same status, publication witness, and release-state test structure.
• git-stunts/git-cas#88: Modifies the same release documentation gating logic for v6.5.x.

Suggested reviewers: git-stunts

Poem

A rabbit tags the release with care,
Signed hashes sparkle in the air.
npm says “latest,” provenance sings,
The witness records all release things.
New goalposts wait where carrots grow.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title is concise and accurately summarizes the main change: recording the git-cas v6.5.2 publication.
Description check	✅ Passed	The description covers linked issue, design/proof, validation, and release impact, matching the template well.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

_{Comment @coderabbitai help to get the list of available commands.}

[flyingrobots]

Self-Code Review: Code-Lawyer Verdict

Severity	Found	Unresolved	Disposition
Critical	0	0	None found
High	0	0	None found
Medium	0	0	None found
Low	1	0	Fixed in 8fdba5b8
Markdown/style	1	0	Release-posture punctuation aligned with neighboring entries

Evidence reviewed

• Confirmed a clean worktree, fetched current refs, and verified the branch is exactly two commits ahead and zero behind origin/main.
• Reviewed all three changed files line by line against origin/main; Graft classified two documentation files and one test file with no structural or breaking changes.
• Re-queried npm, the npm attestation endpoint, the remote signed tag, GitHub Release, and release workflow 29690794540; every recorded identity, digest, size, timestamp, commit, tag, and run identifier matches the external source.
• Verified SLSA provenance resolves v6.5.2 to merge c2d41f608bc9a5e8c19a12ce1024c4c756fd752a and workflow attempt 1.
• git diff --check and touched-file Prettier checks pass.
• Focused release contracts pass: 30/30.
• Pre-commit lint and two pre-push lint/unit runs pass; latest Node unit result is 223 files, 2,080 passed, 2 skipped.

Verdict: no unresolved findings. @codex please independently confirm the immutable release identity and candidate-to-publication state transition.

[flyingrobots]

Addressed the CodeRabbit pre-merge description warning: the PR body now includes the repository-template Linked Issue, Design / Proof, fenced Validation, and Release Impact sections. The issue remains explicitly open until this PR lands so closure can include source citations. @codex please confirm the metadata contract is now satisfied.